Bosch Security Systems IP Cameras Uncontrolled Resource Consumption (CVE-2023-32229)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(505373);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/06/18");

  script_cve_id("CVE-2023-32229");

  script_name(english:"Bosch Security Systems IP Cameras Uncontrolled Resource Consumption (CVE-2023-32229)");

  script_set_attribute(attribute:"synopsis", value:
"The remote OT asset is affected by a vulnerability.");
  script_set_attribute(attribute:"description", value:
"Due to an error in the software interface to the secure element chip
on Bosch IP cameras of family CPP13 and CPP14, the chip can be
permanently damaged when enabling the Stream security option (signing
of the video stream) with option MD5, SHA-1 or SHA-256.

This plugin only works with Tenable.ot.
Please visit https://www.tenable.com/products/tenable-ot for more information.");
  script_set_attribute(attribute:"see_also", value:"https://psirt.bosch.com/security-advisories/BOSCH-SA-435698-BT.html");
  script_set_attribute(attribute:"solution", value:
"Refer to the vendor advisory.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:S/C:N/I:N/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2023-32229");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");
  script_cwe_id(1246, 400);

  script_set_attribute(attribute:"vuln_publication_date", value:"2023/06/15");
  script_set_attribute(attribute:"patch_publication_date", value:"2023/06/15");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/06/17");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:bosch:cpp13_firmware");
  script_set_attribute(attribute:"cpe", value:"cpe:/o:bosch:cpp14_firmware");
  script_set_attribute(attribute:"generated_plugin", value:"former");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Tenable.ot");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("tenable_ot_api_integration.nasl");
  script_require_keys("Tenable.ot/BoschSecuritySystems");

  exit(0);
}


include('tenable_ot_cve_funcs.inc');

get_kb_item_or_exit('Tenable.ot/BoschSecuritySystems');

var asset = tenable_ot::assets::get(vendor:'BoschSecuritySystems');

var vuln_cpes = {
    "cpe:/o:bosch:cpp13_firmware" :
        {"versionEndExcluding" : "8.48.0017", "family" : "BoschCamera"},
    "cpe:/o:bosch:cpp14_firmware" :
        {"versionEndIncluding" : "8.72", "versionStartIncluding" : "8.50", "family" : "BoschCamera"}
};

tenable_ot::cve::compare_and_report(asset:asset, cpes:vuln_cpes, severity:SECURITY_WARNING);